41-80

Question 1

Which command do you enter to verify the Phase 1 status of a VPN connection? 
A. debug crypto isakmp 
B. sh crypto session 
C. sh crypto isakmp sa 
D. sh crypto ipsec sa

Answer 1

sh crypto isakmp sa

Question 2

What are two major considerations when choosing between a SPAN and a TAP when implementing IPS? (Choose two)
A. the amount of bandwidth available
B. the way in which dropped packets will be handled
C. the type of analysis the IPS will perform
D. whether RX and TX signals will use separate ports
E. the way in which media errors will be handled

Answer 2

the amount of bandwidth available

the type of analysis the IPS will perform

Question 3

Which information can you display by executing the show crypto ipsec sa command?
A. proxy information for the connection between two peers
B. IPsec SAs established between two peers
C. recent changes to the IP address of a peer router
D. ISAKMP SAs that are established between two peers

Answer 3

IPsec SAs established between two peers

Question 4

Which command enables port security to use sticky MAC address on a switch?
A. switchport port-security
B. switchport port security mac-address sticky
C. switchport port-security violation protect
D. switchport port-security violation restrict

Answer 4

switchport port security mac-address sticky

Question 5

When would you configure ip dhcp snooping trust command on a switch?
A. when the switch is connected to DHCP server.
B. when the switch is connected to client system.
C. when the switch is serving as an aggregator.
D. when the switch is working in an edge capacity.

Answer 5

when the switch is connected to DHCP server.

Question 6

Which IDS/IPS state misidentifies acceptable behaviour as an attack? 
A. false positive 
B. false negative 
C. true positive 
D. true negative

Answer 6

false positive

Question 7

How is management traffic isolated on a Cisco ASR 1002?

A. Traffic is isolated based upon how you configure routing on the device.
B. There is no management traffic isolation on a Cisco ASR 1002.
C. The management interface is configured in a special VRF that provides traffic isolation from the default routing table.
D. Traffic isolation is done on the VLAN level

Answer 7

The management interface is configured in a special VRF that provides traffic isolation from the default routing table.

Question 8

(SIM1 Q1) Which user authentication method is used when user login to the Clientless SSL VPN portal using https://209.165.201.2/test ?
A. Both Certificate and AAA with local database.
B. AAA with RADIUS server.
C. Both Certificate and AAA with RADIUS server.
D. AAA with LOCAL database.
E. Certificate

Answer 8

AAA with LOCAL database.

Question 9

(SIM1 Q2) When users login to the Clientless SSL VPN using the https://209.165.201.2/test which group policy will be applied? 
A. test 
B. Sales 
C. DefaultRAGroup 
D. DefaultWEBVPNGroup 
E. clientless 
F. DFTGrpPolicy

Answer 9

Sales

Question 10

(SIM1 Q3) Which two statements regarding the ASA VPN configurations are correct? (Choose two)
A. The Inside-SRV bookmark has not been applied to the Sales group policy.
B. The ASA has a certificate issued by an external Certificate Authority associated to the ASDM_Trustpoint1.
C. The Inside-SRV bookmark references the https://10.2.1.1 URL.
D. Anyconnect, IPsec IKEv1 and IPsec IKEv2 VPN access is enabled on the outside interface.
E. Only Clientless SSL VPN VPN access is allowed with the Sales group Policy.
F. The DefaultWEBVPNGroup Connection Profile is using the AAA with Radius server method

Answer 10

Only Clientless SSL VPN VPN access is allowed with the Sales group Policy.

The DefaultWEBVPNGroup Connection Profile is using the AAA with Radius server method

Question 11

(SIM1 Q4) Which four tunnelling protocols are enabled in the DfltGrpPolicy group policy? (Choose four) 
A. IPsec IKEv1 
B. IPsec IKEv2 
C. L2TP/IPsec 
D. Clientless SSL VPN 
E. SSL VPN Client 
F. PPTP

Answer 11

IPsec IKEv1
IPsec IKEv2
L2TP/IPsec
Clientless SSL VPN

Question 12

There are two versions of IKEv1 and IKEv2. Both IKEv1 and IKEv2 protocol operate in phases. IKEv1 operate in two phases. IKEv2 operates in how many phases?
A. 2 B. 3 C. 4 D. 5

Answer 12

2

Question 13

Which command successfully creates an administrative user with a password of “cisco” on a Cisco router?
A. username Operator privilege 7 password Cisco
B. username Operator privilege 1 password Cisco
C. username Operator privilege 15 password Cisco
D. username Operator password cisco privilege 15

Answer 13

username Operator privilege 15 password Cisco

Question 14

Which IPS detection method examines network traffic for preconfigured patterns? 
A. signature-based detection 
B. policy-based detection 
C. anomaly-based detection 
D. honey-pot detection

Answer 14

signature-based detection

Question 15

What is the main purpose of Control Plane Policing?
A. to prevent exhaustion of route-processor resources.
B. to define traffic classes.
C. to organize the egress packet queues.
D. to maintain the policy map.

Answer 15

to prevent exhaustion of route-processor resources.

Question 16

What action must you take on the ISE to blacklist a wired device?

A. Issue a COA request for the device’s MAC address to each access switch in the network.
B. Add the devices MAC address to a list of blacklisted devices.
C. Locate the switch through which the device is connected and push an ACL restricting all access by the device.
D. Revoke the device’s certificate so it is unable to authenticate to the network.

Answer 16

Add the devices MAC address to a list of blacklisted devices.

Question 17

Which term is most closely aligned with the basic purpose of a SIEM solution? 
A. Causality 
B. Accountability 
C. Non-Repudiation 
D. Repudiation

Answer 17

Accountability

basic purpose of a SIEM solution ##

Question 18

Which statement about the native VLAN is true?

A. It is the Cisco-recommended VLAN for user traffic.
B. It is most secure when it is assigned to VLAN1.
C. It is susceptible to VLAN hopping attacks.
D. It is the Cisco recommended VLAN for switch-management traffic.

Answer 18

It is susceptible to VLAN hopping attacks.

Question 19

How does the 802.1x supplicant communicate with the authentication server?

A. The supplicant creates EAP packets and sends them to the authenticator, which translates them into RADIUS and forwards them to the authentication server.
B. The supplicant creates EAP packets and sends them to the authenticator, which encapsulates them into RADIUS and forwards them to the authentication server.
C. The supplicant creates RADIUS packets and sends them to the authenticator, which translates them into EAP and forwards them to the authentication server.
D. The supplicant creates RADIUS packets and sends them to the authenticator, which encapsulates them into EAP and forwards them to the authentication server.

Answer 19

The supplicant creates EAP packets and sends them to the authenticator, which encapsulates them into RADIUS and forwards them to the authentication

Question 20

Which IKE phase 1 parameter can you use to require the site-to-site VPN to use a pre-shared key? 
A. group 
B. hash 
C. authentication 
D. encryption

Answer 20

authentication

Question 21

How can you prevent NAT rules from sending traffic to incorrect interfaces?
A. Configure twice NAT instead of object NAT.
B. Add the no-proxy-arp command to the nat line.
C. Assign the output interface in the NAT statement.
D. Use packet-tracer rules to reroute misrouted NAT entries.

Answer 21

Assign the output interface in the NAT statement.

Question 22

What is the minimum Cisco IOS version that supports zone-based firewalls? 
A. 12.4(6)T 
B. 15.1 
C. 15.0 
D. 12.1T

Answer 22

12.4(6)T

Question 23

Which type of firewall can perform deep packet inspection? 
A. stateless firewall 
B. packet-filtering firewall 
C. application firewall 
D. personal firewal

Answer 23

application firewall

Question 24

What is the best definition of hairpinning?
A. traffic that enters and exits a device through the same interface
B. traffic that tunnels through a device interface
C. traffic that enters one interface on a device and that exits through another interface
D. ingress traffic that traverses the outbound interface on a device

Answer 24

traffic that enters and exits a device through the same interface

Question 25

What are two features of transparent firewall mode? (Choose two) A. It allows some traffic that is blocked in routed mode. B. It conceals the presence of the firewall from attackers. C. It is configured by default. D. It acts as a routed hop in the network. E. It enables the ASA perform as a router

Answer 25

It allows some traffic that is blocked in routed mode. | It conceals the presence of the firewall from attackers.

Question 26

How does the Cisco ASA use Active Directory to authorize VPN users? A. It queries the Active Directory server for a specific attribute for the specific user B. It sends the username and password to retire an ACCEPT or Reject message from the Active Directory server C. It downloads and stores the Active Directory database to query for future authorization D. It redirects requests to the Active Directory server defined for the VPN group

Answer 26

It queries the Active Directory server for a specific attribute for the specific user

Question 27

Which three statements about host-based IPS are true? (Choose three) A. It can view encrypted files B. It can be deployed at the perimeter C. It uses signature-based policies D. It can have more restrictive policies than network-based IPS E. It works with deployed firewalls F. It can generate alerts based on behaviour at the desktop level.

Answer 27

It can view encrypted files It can have more restrictive policies than network-based IPS It can generate alerts based on behaviour at the desktop level.

Question 28

If a router configuration includes the line aaa authentication login default group tacacs+ enable, which events will occur when the TACACS+ server returns an error? (Choose two) A. The user will be prompted to authenticate using the enable password B. Authentication attempts to the router will be denied C. Authentication will use the router`s local database D. Authentication attempts will be sent to the TACACS+ server

Answer 28

he user will be prompted to authenticate using the enable password. Authentication attempts will be sent to the TACACS+ server

Question 29

``` Which of encryption technology has the broadest platform support to protect operating systems? A. middleware B. hardware C. software D. file-leve ```

Answer 29

software

Question 30

``` Which technology can be used to rate data fidelity and to provide an authenticated hash for data A. network blocking B. signature updates C. file analysis D. file reputation ```

Answer 30

file reputation

Question 31

``` Your security team has discovered a malicious program that has been harvesting the CEO’s email messages and the company’s user database for the last 6 months. What type of attack did your team discover? (Choose two) A. social activism B. drive-by spyware C. targeted malware D. advance persistent threat E. Polymorphic virus…………… ```

Answer 31

targeted malware advance persistent threat

Question 32

If the native VLAN on a trunk is different on each end of the link, what is a potential consequence? A. The interface on both switches may shut down B. STP loops may occur C. The switch with the higher native VLAN may shut down D. The interface with the lower native VLAN may shut down

Answer 32

STP loops may occur

Question 33

When using Cisco cloud web protection, in what case proxy scanning is skipped. A. When connected by wired connection. B. When connected using wpa2 connection. C. When connected to trusted corporate network. D. When connected via vpn with proxy scanning skipped service.

Answer 33

When connected to trusted corporate network.

Question 34

Which effect of the secure boot-image command is true? A. It configures the device to boot to secure IOS image B. It displays the status of the bootset C. It archives a secure copy of the IOS image D. It archives a secure copy of the device configuration

Answer 34

It archives a secure copy of the IOS image

Question 35

``` On which operating system does the Cisco Email Security Appliance run? A. Cisco IOS XR B. Cisco IOS XE C. Cisco AsyncOS D. Cisco NX-OS E. Cisco ESA-OS ```

Answer 35

Cisco AsyncOS

Question 36

You are configuring an IPS that must be able to react to potential attack. Which deployment method do you use? A. Passive deployment that uses failsafe B. Passive deployment that uses tap mode C. Inline deployment that uses a SPAN D. Transparent Inline Mode

Answer 36

Transparent Inline Mode

Question 37

Refer to the exhibit. Your notice the error message in the syslog. Which command do you enter on the switch to gather more information? %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Res) on Fa0/10, vlan 200 A. show ip dhcp snooping binding B. show mac address-table C. show ip arp D. show ip source binding

Answer 37

show ip dhcp snooping binding

Question 38

Which two statement about STP attacks are true? (Choose two) A. The attacker sets up a rogue DHCP server to intercept requests B. They can be performed only when Cisco Discovery protocol is running C. Then can mitigate by disabling STP D. They can create the opportunity for subsequent man-in-the middle attacks E. The attacker sends BPDU messages to become the root bridge F. They can be executed only from a hub

Answer 38

They can create the opportunity for subsequent man-in-the middle attacks The attacker sends BPDU messages to become the root bridge

Question 39

Which statement about TACACS+ is true? A. TACACS+ is used for user access to network resources more than administrative access to network devices. B. All data that is transmitted between the client and TACACS+ server is cleartext. C. TACACS+ server listens UDP port 1813 for accounting. D. TACACS+ is more flexible than RADIUS because it separates all AAA into individual process. E. Password are transmitted between the client and server using MD5 hashing.

Answer 39

TACACS+ is more flexible than RADIUS because it separates all AAA into individual process.

Question 40

You are configuring a site-to-site tunnel between two cisco routers by using IPsec. Which option do you set to specify the peer to which you want to connect? A. IP address by using a crypto map B. IP address of tunnel destination C. Tunnel group that has a peer P address D. IP address as part of the ISAKMP configuration

Answer 40

IP address by using a crypto map